Analysis
-
max time kernel
178s -
max time network
149s -
platform
android_x64 -
resource
android-x64-20240514-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system -
submitted
22-05-2024 16:58
Static task
static1
Behavioral task
behavioral1
Sample
67f465f3390b181f1dd8d2b5c1eeb521_JaffaCakes118.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral2
Sample
67f465f3390b181f1dd8d2b5c1eeb521_JaffaCakes118.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral3
Sample
ixintui_plugin.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral4
Sample
ixintui_plugin.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral5
Sample
ixintui_plugin.apk
Resource
android-x64-arm64-20240514-en
Behavioral task
behavioral6
Sample
stat_plugin.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral7
Sample
stat_plugin.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral8
Sample
stat_plugin.apk
Resource
android-x64-arm64-20240514-en
General
-
Target
67f465f3390b181f1dd8d2b5c1eeb521_JaffaCakes118.apk
-
Size
3.8MB
-
MD5
67f465f3390b181f1dd8d2b5c1eeb521
-
SHA1
38eee93cb11a620f990819f9df5422e85c641061
-
SHA256
e6b9441bf831daa31a34ad7afd9a6f6777381c2b367892000d9f42c5d01e3292
-
SHA512
6497265bf748bd67b1369cf3822b803a9f99243792ec6930473aa49a1c371ef22bfe35d8c3efd252d602646240a1341836cc8a7ae86d4b7c475a94695c55c744
-
SSDEEP
98304:bGq6flX47Rh+qC4pWQlI4C380WfHkA4CulJGO+YeUAroPH9rs1:bGq6flI7Rh+qtpVlI4Tv/kHhWoPHk
Malware Config
Signatures
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
Processes:
com.mayizaixian.myzxdescription ioc process File opened for read /proc/cpuinfo com.mayizaixian.myzx -
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
Processes:
com.mayizaixian.myzxdescription ioc process File opened for read /proc/meminfo com.mayizaixian.myzx -
Loads dropped Dex/Jar 1 TTPs 4 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.mayizaixian.myzxcom.mayizaixian.myzx:ixintui_service_v1ioc pid process /data/user/0/com.mayizaixian.myzx/files/ixintui_plugin.jar 5152 com.mayizaixian.myzx /data/user/0/com.mayizaixian.myzx/files/stat_plugin.jar 5152 com.mayizaixian.myzx /data/user/0/com.mayizaixian.myzx/files/ixintui_plugin.jar 5366 com.mayizaixian.myzx:ixintui_service_v1 /data/user/0/com.mayizaixian.myzx/files/stat_plugin.jar 5366 com.mayizaixian.myzx:ixintui_service_v1 -
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
Processes:
com.mayizaixian.myzxdescription ioc process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.mayizaixian.myzx -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
Processes:
com.mayizaixian.myzxdescription ioc process Framework service call android.app.IActivityManager.getRunningAppProcesses com.mayizaixian.myzx -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
Processes:
com.mayizaixian.myzxdescription ioc process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.mayizaixian.myzx -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
com.mayizaixian.myzxdescription ioc process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.mayizaixian.myzx -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
Processes:
com.mayizaixian.myzxcom.mayizaixian.myzx:ixintui_service_v1description ioc process Framework service call android.app.IActivityManager.registerReceiver com.mayizaixian.myzx Framework service call android.app.IActivityManager.registerReceiver com.mayizaixian.myzx:ixintui_service_v1 -
Checks if the internet connection is available 1 TTPs 1 IoCs
Processes:
com.mayizaixian.myzxdescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.mayizaixian.myzx -
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
com.mayizaixian.myzxdescription ioc process Framework API call javax.crypto.Cipher.doFinal com.mayizaixian.myzx
Processes
-
com.mayizaixian.myzx1⤵
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:5152
-
com.mayizaixian.myzx:ixintui_service_v11⤵
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:5366
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.mayizaixian.myzx/databases/ThrowalbeLog.dbFilesize
28KB
MD59bf5f66a1470610bde57127432f2701a
SHA151fadba5c7896d5ff4edd33a8cc4f29da3e5060e
SHA25603be0bcc9323a0328d6e47197bce803076d36f53e5cde4ebe700cc81e580aad8
SHA5120bed5033feb5809e68606c16d85ae23bc44324ab88a26cc694930b067cbd95058f296a6a57bb98375db2c09263102e6e9dc8b4fe12360867dd05e2e61b053161
-
/data/data/com.mayizaixian.myzx/databases/ThrowalbeLog.db-journalFilesize
512B
MD551cbd0b414d9ccab7bf949e599de3791
SHA133f5ebee525b0745651b69d2ac72b54923c8068a
SHA256dd3eaa010ca4e23fed7304addaa6432da75cc19180ad7e1d670349de78165ef8
SHA512db176c58f1d1442300453b9ed257c0211f7d4be7921e8a0fb0e9cef23fd5fee14baa44f3c35a46e2eea51b54088a03645e887d2b8965a2a5733b8eb5ab2781b4
-
/data/data/com.mayizaixian.myzx/databases/ThrowalbeLog.db-journalFilesize
8KB
MD566d4a32818f5858a3a3461b9293ac40b
SHA1f76d2993e0527075a42f7fbc84e95695f27ad244
SHA256ef2178340e36dcb65e8f81d4edf38d2488edc999bb2cc91d088c7c79e6cc8c08
SHA512987fb29f6152ef03007f01f657ec5ba685d80447b2e0f3f6c79fd01a73ba223addb3fc151df9642f447cc1e88c7be9af4138e89e5025b9160cd41c932f6671e5
-
/data/data/com.mayizaixian.myzx/databases/ThrowalbeLog.db-journalFilesize
8KB
MD539bff93a87f375270c83cb5064cffda9
SHA1588da912cb5cf59f304b8d7f7e3b7dd29c4c283b
SHA2564f47bd41c0a183ae15ce3877cafb5f89ef0e7f2fe563ddf295b9246ff879ca3f
SHA51252a3d005d4f3228ccb767ea9e0ddb6656603d3a8dd366815bb8624a80e2735fc8644238eacbd3e84a303c641602a1fc83e00e11e3018a32b4c5b87b6ec327abd
-
/data/data/com.mayizaixian.myzx/databases/ThrowalbeLog.db-journalFilesize
12KB
MD56afad6d46badb8d84671c07f8443e903
SHA1de21f9c3640592faf4a4c09a9dce2af8d8ee22a9
SHA2569e6fc325d5a07e0ca342178b8e1d1e013a8c095cb6b036eb90950ca4c9cc8e06
SHA512526010d1ea432fbee599fe7018ba1c1f49e26449616dbda252523f77e6f00be4f1be8a3e3e2691b7458731d0851f67e3358bacfbe0cdd704729552342f3c1e30
-
/data/data/com.mayizaixian.myzx/databases/ThrowalbeLog.db-journalFilesize
16KB
MD5012dde9bd05f94172fc79132b2ae7e2b
SHA17f983640f752148adc13b5e127d0f97675ab1340
SHA25646c9eb79f2026e87f80bb95e9fa98c5ad6c1477176e1fa2393cff6277cba9bc5
SHA512601478ea89fa34b36f8dac1ff2ba53bf2e2213a7a8448918e27bc4c17fa9a758c1c1749c1dbc8e5533383c800127707dcd6316496b25baee86780802a36eb4b2
-
/data/data/com.mayizaixian.myzx/databases/com.ixintui.push.dataFilesize
28KB
MD51a8dbe6f185573fca9fa253fb66df8bf
SHA14d537d5cf1f3ff6f556c748b2033e5255737d039
SHA256a79b50f82ffccd49a530a3dd694d8faad11f966b4de5ebea0083ff1e596db041
SHA512022cccf4161b8aae9c4eefb224129c2c1cfa30aa0afadbf74607b5bfc4d5cf2049c812039351fa41eb881c51c0d263cb6445f8306fd1478fed540188b3391d3b
-
/data/data/com.mayizaixian.myzx/databases/com.ixintui.push.data-journalFilesize
8KB
MD5f1bbf3e83a740017e48c76b1347805e6
SHA174a49c1672cf0915db8c1aa4f5d9396eecfdf568
SHA2569d7a47581f2edfc787976f8c3cd47a811bb62e345db5b20c6b28bb4f47a5b939
SHA5127b0f3e40208a223f3634cc0d5b4390e739c552da34ce8f02845a7c3366a01639f4a1b6bf896ba2e41693983fc1ec8063aee9dd72926a001a9c9fffc5ef178a97
-
/data/data/com.mayizaixian.myzx/databases/com.ixintui.push.data-journalFilesize
16KB
MD5e2e0c0fd763e867f2e9d51dddf8a9d14
SHA12042915a8d52be5292e801dc37185f0bcb85e979
SHA256e0d1db04915b030505e13e3ce49d3bb2cb8837570b9c6b9ba0d4025b51a28787
SHA512e26266c9dca619cc51d8c8954e55c1a1e3a565bbcc4409c825f533f0baba363ee72ff9eac1873f82b61e7d5ddb37fb6e90935c5e003038b0829d81b0434380d8
-
/data/data/com.mayizaixian.myzx/databases/com.ixintui.push.data-journalFilesize
8KB
MD50a37a1283de533384108598ffe9fffd6
SHA130f44cd3a48b3a4e04e3f193156474d8cc0308d7
SHA25600b8f5a7ac63448fa957187d9cc5604b899a846655fb554a4e7c98b47537debc
SHA5122184e61f16197f5bc00223e39fa19d065c6e89728446125049ed33218d18404292bb3af7cccb1300854ff3e173c8a247eacbb1229c2b5a43ffbd4ef3b7efb955
-
/data/data/com.mayizaixian.myzx/databases/com.ixintui.push.data-journalFilesize
8KB
MD5c328134f3ea32ef879b2f77836d30b1b
SHA18a1c56bd33203e920955c4196ac0db8f429ac26a
SHA25655ae9b5cbca3955f7d08b1e3e9b05f5893d046a6d08b9129c16ade317c8c4df0
SHA5120d1870cfc93c2b3424d7d903429fa2a7e4db8c78faf460ffa673de2fefa61db5e27c6e1bf4c508766b9880be473d073b0780252bc182998bda53ddd59fa03bae
-
/data/data/com.mayizaixian.myzx/databases/com.ixintui.push.data-journalFilesize
512B
MD512ee6d8a55196ef62635d83ac6762f53
SHA1453cb8ae294368496feb3c2d4ac0d8f89d7a146f
SHA256999dffd25725d43bd7debfc954ad485d553f2cb2377300c4f51ed175d18a84f2
SHA512b66c3e1df2526e70165ba0c7c1dc7113acc4e24a73ea935bad77356ab0514b7a2139b73171e8f849d857f527a3ef1148e6468230db84365ccc8bbb565b0bd204
-
/data/data/com.mayizaixian.myzx/databases/com.ixintui.push.data-journalFilesize
8KB
MD55b2e1acb41ec090861947e3f109251de
SHA13e1014c39bda0385fbd1e8cf5c4ea838056ab326
SHA256db72b04f08903520907db188c1dbdffbe81478e07c55261850ed468c34dd35ca
SHA512484d4dd647c9e77400ae95d595289097dbb3466a54ad5655f8c23c55c718483676ce7b1273012523b9bfaf08d855d94bd1432749a3bf4e160371c2884a9cd1e8
-
/data/data/com.mayizaixian.myzx/databases/com.ixintui.stat.basic_dbFilesize
24KB
MD5aeefa734168cb1f1e23e81ee65f1d029
SHA173a58265629fa44137257fe269502ebace087e94
SHA256c7088a999f5d44475ee07d9d52a287d4a60e7d18f709ec7f34ff81c233f62081
SHA512c89c3ac0083bfda24f62ac73fff99bfe4bdd5df696e467d9251de23b7ad783d33e9f7de29c4c9286b4b7a6a0967e40a969b31f3228ede10ba73452fe4327a038
-
/data/data/com.mayizaixian.myzx/databases/com.ixintui.stat.basic_db-journalFilesize
512B
MD5c187cc33f996a508249dd599484e8bf2
SHA1240f8aa5856deffd9ab7b45e1c3cc3d6d039120f
SHA256a116f5f6d4e7ef3dfc2f9ad96c5e1fe816cc6e7a17f16f4f140b9ca920641525
SHA512d0ab3cd930094e3857b8fa2954ad121bab0722564ab0d2056f0ead8d212f8f8b9269471dbe05149e6b4daa39799a5659c200a5a065f18b99a3fcb06fc8ae7499
-
/data/data/com.mayizaixian.myzx/databases/com.ixintui.stat.basic_db-journalFilesize
8KB
MD57f0fa37cd86c0722a84fb4b93d6f7b56
SHA124912831ad9a266a9a6a06c9a156085a80a49f9e
SHA2563445c5f861c9ef1d1a24d9f08a1850d7362085b3b05a3cde334091d1552b4fc8
SHA5120d193d69d19aec75c36a3e829c5c8f362c3ccb31b1b6bd8be868830caa961f7ce48da8e55d406e77adbc4a0405b743594ddc24d930c74596a81e006024149ee0
-
/data/data/com.mayizaixian.myzx/databases/com.ixintui.stat.basic_db-journalFilesize
8KB
MD5e2ada4c1442aea59f00cdfffb0bb76c0
SHA1b02de9a76412b860863162b4a96e4ad134b680c7
SHA256fc7307c312072629d32c385668fcbca5bb16cdabc020eaf3dd8df4fc9654afc7
SHA512d1e860014908b6fff2555af22a2e61b5b3be066baa0ec04a6389482934a92a97650ed5240727310b94efaf110d6a44afb68fb32c1df0b14d013b491bec2cf1d9
-
/data/data/com.mayizaixian.myzx/databases/com.ixintui.stat.basic_db-journalFilesize
16KB
MD5564f389ad4180793a5560116693c534d
SHA1b73e336359fd1b48ce5c971d777063d00e102f73
SHA25680b507cb1e283cbf4b2479bd1e95d7225b0e17125ee70cb33382e3adafb379c5
SHA51244fbd2fa6633aab790998857dc120834214de67af947b1c1cabe3b95cf0fe5a70f2c3bed82680bac7dd9be1c03ee8d4801c44a0c6ad8d711bb3998491be10eae
-
/data/data/com.mayizaixian.myzx/databases/com.ixintui.stat.basic_db-journalFilesize
16KB
MD5086fb097ed809688ad22c35aa9685162
SHA1defef938343730a6693c2f400b8354e4a9d35432
SHA25629b9478fa6de393bb1082807ba8056182951aa75b5c5405d1b11ac597ee26ca4
SHA51246baa11ace96a109f60f766a9cc315db1951f00b8c7451e480ee73ad95ce3013bede98ea2aec235d06cfa647e82f3c3689f38250cab4ae1b01b6f29068b6f810
-
/data/data/com.mayizaixian.myzx/databases/com.ixintui.stat.basic_db-journalFilesize
16KB
MD5463b6aac4905cbddc79a57fe98d038a9
SHA16cd1132b16022589e59804ff6eff5934e1bc2b7c
SHA256083b223da5bc7472b5a11a5513fe1191f41661709b15d7485d61c7e20fd73288
SHA512032988404a7b9e648f562811ec035e485259da9fbc7a909ec6fd9d813f7f153b8fb5161537a58616163c3a5aaf0d2b36f0527f50d2bad2e2da2a5e40dca66f2f
-
/data/data/com.mayizaixian.myzx/files/.um/um_cache_1716397159865.envFilesize
591B
MD5036e4515785dd73fad4d3c4183c8b422
SHA18f7db600d0ba3a442e1ca0ad069a3768c6da4d70
SHA2567076eb285875ec65ebf0fe387d5fce83e99b1e26b6dc8b8ecc86104aedaba3ed
SHA512035b1110c92e59ce7eb75ac2588c53658de960c9c7cb173ebf7d29235ef49478bba18fa2d4ea437b1e322ea8379520c899d0e4b5e2c98d9efce3a148edb8cdd2
-
/data/data/com.mayizaixian.myzx/files/.umeng/exchangeIdentity.jsonFilesize
162B
MD56bd2ac61d28a0fdf82b6e53592def221
SHA10cf9e1912d71f56f39961c5310a4cf47f168befd
SHA256a5b6efd6f20495a273abec27e0ed6ef40e114edf2361b5fbc8bf1c730c7bd3ab
SHA512c8720942603e014f79ca9f31fcb33bdd5c5b801577ebe69a4f6eaec45ee3abf69ed2901f76604926a0f7ba54a32d896d9d6e484cb6d2861777c0a39b2c08cac2
-
/data/data/com.mayizaixian.myzx/files/ixintui_plugin.jarFilesize
54KB
MD50fd5745abb8efd27d19339cb8bf74c31
SHA10514c079304f4ca950dca9c5071fc8f149a644f2
SHA256fee09a01b0393e0ee0d4e344b798d990be0783be31b6d8829a6aa9329928a848
SHA512598e6cd7ab9c7147cd532d3c491e3a7158068b7024a8293c9c99cb32e5d1dce0800e3f42b8914380156a0901973c9ced495aee3d9c628f674bc0b23472d2bb96
-
/data/data/com.mayizaixian.myzx/files/oat/ixintui_plugin.jar.cur.profFilesize
328B
MD58364b9f6ced4252e25bc2de9dbd2cf7b
SHA10a102bace59c38b380964acb0f953d4d1837ba9d
SHA256b58bf636acfe37f86e41c345de589a4ac4b80facc3b3d6dca0aec7440662034e
SHA512ea26faba3f39c11c956706fd071bd9a92e2c7f11389a4193a4efd973638d9670b320e39e519282804a92c6f4fd583fa9e20c88d65d5af659cacd1cf09958a9be
-
/data/data/com.mayizaixian.myzx/files/oat/stat_plugin.jar.cur.profFilesize
115B
MD543034cc2f3f0ee8a6e19c10421521083
SHA1e969fa65f10d8f1e742d7418f919d52f95554e5a
SHA256e183ad362345bf23c31fc70eab961df2bd82ca9f2cc6bba4f01f9b3a13b3615e
SHA512038aaa33b06e776df8d9c44f2a33af9401fbd1823a5916ac50409325efc72d6e81b97c70148aeaa72a04b184b1551a2aab2fc497f209353347b77a0782dc7531
-
/data/data/com.mayizaixian.myzx/files/stat_plugin.jarFilesize
11KB
MD56407165af23fa8b3ecf0d65664d316e0
SHA160a74d827d9b9d80344e9f8669dc520f6d1f5a1b
SHA25666b2e6169631facc018b1ceb4c7b15b406abe2fcc0d04207ad185ea53304b4fa
SHA512c06fc91bc9d9637c634d2e08e90295885c76a765444d0e552d33630c5f591870bc0a8b823d6e26394de131f610a0f72829e42999a4bb38f2894356a410be564e
-
/data/data/com.mayizaixian.myzx/files/umeng_it.cacheFilesize
245B
MD526948c936ea9ebb290c7ba05d270033f
SHA124e04cf17f70f7226242bfc60fc2952540fed95f
SHA256974deb37a573b3a7a06401b45fc22c23e7f2dc25311076a816bc5c6d85701d3b
SHA512a919811a0e64bb24bb2d135b5b6e6994a96c4bb7e55d8765ac7518770fc0a12b5febed5bfb84eff28050560b2a3ee15c99bbd082c71f3a63ad87753cc1803fb5
-
/data/user/0/com.mayizaixian.myzx/files/ixintui_plugin.jarFilesize
119KB
MD53bcf8974e4cdf927afb37d9e62e8f5ae
SHA1cb28d4153b06de6f278888be699a44217ace784d
SHA256d47323aae8216609741ff960eae9649086451d4399c67fb813b6a2f6abb2f841
SHA51283cbaaef1cee4d83d184e4766708239829d3c512864fecc9e9d75e7318d6bde45bdcde472d116c9effdb70d13967709fd4d7eaaf9b4a58dfc0ec923437498e04
-
/data/user/0/com.mayizaixian.myzx/files/stat_plugin.jarFilesize
22KB
MD5fbfd3d5c8dfdfb06f712bbc4db2645eb
SHA10bcaac6931feb1262c618c12040dd43ad13d0b61
SHA256be9ad9cfad08657b6ebb1a4ed6ab1dc24d817cac644605bad6fa85b3ecbc8059
SHA51207401ec8e2024ffce0d8264e9ba6abd061c3c16f33acbb3836b9523e0969ff1fc48f8d84621fa7d2f50390d2cab730d2a3467e8e90f2f60dc929e63ee2af8537
-
/storage/emulated/0/ShareSDK/.baFilesize
377B
MD56a3745be7f7fa0cdfad2037824e34300
SHA14e7f86dc0032e328311fb026d0b4de87ea2e1a6c
SHA2562d8cfdcbbbffaff0848df059a890576963daaa0e0fc8111305b8d1f041a1c455
SHA512cb8ff2f731f844e1dba81ab9c862fa42cfc3173d1970e3682e32340c579251bd924ec5a9ec62226c61b36a5ddce06ae7735988548ace750d310135f502494243
-
/storage/emulated/0/ShareSDK/.baFilesize
476B
MD59f2ab444546f6dc7b0157046029cf95b
SHA13e0c4eb9f42f66636b9ed43a2d7de3e06e408ab1
SHA256d7dd9c1ebf7852d5a2f07edb56939d155635aaf51701a52b6b513ddb947967cd
SHA5122790b4970042b38f6477d5606423ab9c6120a721da4449ac2837724334d2ddeb7fe43e4e15b03f43ae2f96bf56accff8d2a67751f28e8f7a54468ecc66b7712b
-
/storage/emulated/0/ShareSDK/.dkFilesize
107B
MD59571b8148c1d4d267bd088138efaa1b6
SHA106446151883ecc2a6c829990d8c7e050796aa978
SHA256a9d51edcf4925ecc9101191acdd74f1f1b8f7132be569188d38431a82c90c852
SHA512f8bbc044871265a978c098f47960eb6184d87e03017935fb536510f18233028d7fd5d8c1b0d96f055dcd527a133e2f4c8c07b8ba6defe348047bb7b6b40934d8